A Novel Sparse Active Online Learning Framework for Fast and Accurate Streaming Anomaly Detection Over Data Streams

1 Introduction

Online Anomaly Detection (OAD) is a critical technique for identifying deviations from established behavioral patterns in real-time data streams, enabling timely responses to irregularities [O'Reilly et al., 2014; Salehi et al., 2016; Guha et al., 2016; Manzoor et al., 2018; Lai et al., 2020; Chen et al., 2023; Chen et al., 2024b]. It has broad applications in various domains, including intrusion and fraud detection [Muhammad et al., 2020], financial and web services [Pazarbasioglu et al., 2020], network security management [Du, 2022], and public health or military surveillance [Burkle, 2020]. Early anomaly detection is crucial for minimizing operational disruptions, enhancing troubleshooting efficiency, and facilitating rapid corrective actions, thereby safeguarding system integrity and ensuring continuity in dynamic environments.

∗Corresponding author: Dr. Yi He (yihe@wm.edu)

Subspace learning-based anomaly detection methods have recently gained significant attention by identifying orthogonal subspaces that capture latent patterns in data from unknown distributions [Li et al., 2011; He et al., 2017; Chen et al., 2021; Zhang and Zhao, 2022]. These methods reduce the dimensionality of input data into low-dimensional subspaces, enhancing structural representation while mitigating noise. Prominent approaches such as online oversampling Principal Component Analysis (osPCA) [Lee et al., 2012] and sketch-OAD [Huang and Kasiviswanathan, 2015] leverage matrix sketching, which maintains compact sets of orthogonal vectors to approximate data streams efficiently. Complementing these, non-parametric methods such as Very Fast Decision Tree (VFDT) [Tan et al., 2011] and Hoeffding Anytime Tree (HATT) [Bifet et al., 2017] address concept drift challenges, offering interpretable solutions for evolving data streams. Recent advancements integrate online deep learning frameworks [Sahoo et al., 2018; Lian et al., 2022], yielding robust models like the adaptive deep log anomaly detector (Ada) [Yuan et al., 2020], deep autoencoding Gaussian mixture model (DAGMM) [Zong et al., 2018], and an adaptive model pooling approach for online deep anomaly detection (ARCUS) [Yoon et al., 2022], which adapt dynamically to complex, evolving data streams. These innovations collectively enhance detection accuracy, scalability, and adaptability in real-time anomaly identification.

Residual analysis has emerged as a promising approach for effective anomaly detection by examining discrepancies between observed data and their reconstructed estimates, where anomalies are identified through abnormally large residual errors resulting from deviations from dominant patterns [Tong and Lin, 2011; Peng et al., 2018; Ding et al., 2019]. A commonly employed strategy involves reconstructing data using representative instances, but challenges arise due to noisy or irrelevant attributes, necessitating the simultaneous selection of structurally relevant attributes and informative instances for accurate reconstruction. To address this, recent advancements pivot from traditional factorization methods to online CUR decomposition, which offers enhanced interpretability by dynamically maintaining low-rank approximations through curated subsets of instances and attributes over time. This method not only improves noise resilience but also provides a transparent framework for temporal instance and attribute selection, enabling real-time anomaly detection in evolving data streams. By integrating residual analysis with interpretable online decomposition, the approach systematically isolates anomalies while preserving the integrity of underlying data structures, thereby enhancing detection accuracy and adaptability in dynamic environments.

Despite advancements, OAD remains challenging due to several persistent issues. Firstly, the context-dependent nature of anomalies, where definitions vary across applications, precludes one-size-fits-all solutions, and while densitybased anomaly scoring [O'Reilly et al., 2014] is common, it struggles in high-dimensional, open feature spaces where distance metrics lose discriminative power [He et al., 2019; Wu et al., 2023; Schreckenberger et al., 2023; He et al., 2023; Chen et al., 2024a]. Secondly, catastrophic forgetting in streaming models necessitates rapid anomaly identification and model updates before subsequent data arrives. Thirdly, severe class imbalance arises as normal data overwhelms anomalies, skewing detection accuracy. Lastly, balancing detection efficiency with minimizing false positives is critical to avoid alarm fatigue while ensuring timely anomaly capture. To tackle these issues, we propose integrating ℓ1,2-normbased sparse online learning with CUR decomposition-based online active learning, enabling concurrent streaming feature selection and instance curation. This hybrid approach mitigates dimensionality challenges and catastrophic forgetting while enhancing interpretability. By dynamically prioritizing sparse, informative features and representative instances, the framework supports robust residual analysis for precise OAD, ensuring adaptability and scalability in evolving data streams.

1.1 Motivation

Effective OAD hinges on the dynamic selection of representative features and informative instances to mitigate catastrophic forgetting, ensuring incremental model updates retain critical patterns. While existing subspace selection methods [Li et al., 2011; He et al., 2017] isolate anomalies through preprocessing steps, their decoupled optimization from detection pipelines risks suboptimal performance. To overcome this, we propose a unified framework integrating ℓ1,2-normbased sparse online learning for feature sparsity and CUR decomposition-based active learning for instance selection, synergistically optimizing both processes in streaming settings. This approach leverages residual analysis from online CUR decomposition to quantify instance normality, where anomalies exhibit disproportionately large reconstruction errors compared to normal data (Figure 1). By jointly prioritizing sparse, discriminative features and representative instances, the method enhances adaptability to evolving data streams while maintaining interpretability, addressing dimensionality challenges and alleviating catastrophic forgetting.

1.2 Contribution

In this paper, we propose an effective streaming anomaly detection (SAD) method from a sparse active online learning perspective. Technically, our main idea is to seamlessly integrate the ℓ1,2-norm based sparse online learning and the CUR decomposition based online active learning, leading to an effective residual analysis for SAD. On one hand, SAD is able to provide real-time feature interpretations by leveraging the benefits of the ℓ1,2-norm penalty. On the other hand, SAD can automatically detect anomalies in streaming data based on the CUR decomposition theory, which does not require hand-set thresholds and makes no assumption on the data distribution. The main contributions of our work are as follows:

• We introduce a new perspective that optimizes feature and instance selection and anomaly detection as a whole instead of treating them as multiple separate steps.
• We leverage the power of sparse online learning and CUR decomposition with residual analysis to learn and detect anomalies in an online fashion.
• We evaluate the performance of the proposed framework on real-world streaming datasets and compare SAD with multiple online anomaly detection competitors.

2 RelatedWork

Anomaly detection in data streams has been addressed through diverse learning strategies, including k-nearest neighbors (kNN), kernel density estimation (KDE), isolation forest (iForest) [Xiang et al., 2023], extended isolation forest (EIF) [Hariri et al., 2019], and locality-sensitive hashing (LSH) [Meira et al., 2022]. kNN-based methods like NETS [Yoon et al., 2019] (with set-based updates) and MDUAL [Yoon et al., 2021] (leveraging data-query duality) identify outliers through proximity queries, while local outlier factor variants such as MiLOF [Salehi et al., 2016] (using summarization) and DILOF [Na et al., 2018] (via sampling) focus on density deviations. KDE-based STARE [Yoon et al., 2020] accelerates anomaly scoring by skipping stationary regions during density updates, and LSH-driven MStream [Yoon et al., 2020] combines hashing with dimensionality reduction for efficient streaming. Isolation forest adaptations such as RRCF [Guha et al., 2016] employ tree ensembles and sketching to handle concept drift. While these methods adopt window-based processing to manage evolving streams, their primary emphasis lies on minimizing computational costs for incremental model updates or preconfigured ensembles, often relying on manual feature engineering, such as random subsampling, linear transformations, or dimensionality reduction that restricts scalability and generalizability [Pang et al., 2018]. This dependence on handcrafted features limits their adaptability to complex and high-dimensional data dynamics.

Recent advances in online anomaly detection span diverse methodologies to address evolving data streams. Xie et al. [2018] introduce OnlineBPCA, enhancing Bayesian PCA to jointly model row and column principal direction variations for precise real-time detection. Pei et al. [2023] leverage succinct tensor sketches to dynamically maintain subspaces representing non-anomalous historical data, enabling rapid outlier scoring for incoming streams. Siffer et al. [2017] apply extreme value theory to identify outliers in high-throughput time series, while Wang et al. [2020] propose incremental frameworks (FKDA-X, FKDA-CX, FKDA-C) for novelty detection in unlabeled chunk data streams. Boniol et al. [2021] develop SAND, a domain-agnostic method adaptive to distribution drifts, and Bhatia et al. [2023] extend higher-order sketches to preserve dense subgraph structures in streaming graphs. These approaches collectively advance real-time detection through adaptive subspace maintenance, statistical modeling, and incremental learning, though challenges persist in balancing accuracy, scalability, and interpretability. For a comprehensive overview, please refer to a recent survey [Bouman et al., 2024].

Our proposed framework introduces a novel paradigm for OAD by synergizing ℓ1,2-mixed norm-based sparse online learning with CUR decomposition-driven active learning, enabling dynamic, assumption-free identification of anomalies in large-scale streaming data. Unlike existing methods that often rely on predefined data distributions or disjoint optimization of feature selection and detection, our approach unifies sparse feature regularization and representative instance curation in a single streaming workflow. The ℓ1,2-norm promotes row sparsity to discard redundant features in highdimensional streams, while online CUR decomposition actively selects informative instances, maintaining a low-rank approximation that captures evolving patterns. This dual optimization facilitates robust residual analysis, where anomalies are flagged via large reconstruction errors derived directly from the sparse and interpretable CUR basis, eliminating reliance on distributional assumptions.

3 ProposedMethod

3.1 ProblemFormulation of OAD

In online anomaly detection for streaming data, we consider a continuous sequence D = {x1, x2, · · · , xt, · · · }, where each instance xt ∈ Rd arrives at timestamp t in a d-dimensional feature space. The objective is to identify rare instances that deviate substantially from the majority of reference data points over time. At each timestamp t, the task involves computing an anomaly score, quantifying the "abnormality" of xt, and classifying the instance via predefined rules (e.g., thresholding), where yt = 1 denotes an anomaly and yt = -1 a normal instance. Our approach leverages CUR decomposition-based residual errors to derive these scores, measuring the discrepancy between observed and reconstructed data. Crucially, as both normal and anomalous data distributions evolve dynamically, the detection framework must continuously adapt to shifting patterns. This necessitates an online mechanism that updates its reference model incrementally, ensuring robust anomaly identification in non-stationary, high-dimensional streams while avoiding reliance on static assumptions about data behavior.

3.2 Online Convex Optimization for OAD

Online convex optimization (OCO) [Shalev-Shwartz and others, 2012] provides a formal framework for online learning and OAD, modeled as an iterative interaction between a learner and a dynamic environment. In this setup, the learner iteratively selects a model parameter wt from a convex set S ⊆ Rd at each timestep t. The process unfolds as follows: upon receiving an instance xt, the learner predicts, incurs a convex loss ℓt(wt, (xt, yt)) upon observing the true label yt, and updates wt to wt+1 via mechanisms such as online gradient descent: wt+1 = wt - λt▽ℓt(wt, (xt, yt)), where λt > 0 governs the step size. This framework enables adaptive decision-making in adversarial or non-stationary environments by balancing immediate regret minimization with long-termmodel stability, making it foundational for streaming applications requiring continuous adaptation.

In general, the goal of OCO is to iteratively select model parameters {wt} that minimize cumulative loss over time, despite adversarially chosen convex loss functions ℓt revealed only after each prediction. The performance metric is regret, defined as the difference between the learner's total loss and the minimal loss achievable by a fixed optimal model w⋆ ∈ S in hindsight: RegretT = ∑Tt=1 ℓt(wt, (xt, yt)) - ∑Tt=1 ℓt(w⋆ , (xt, yt)), where the first term represents the learner's actual loss and the second term the best possible loss with perfect hindsight. Common loss functions include the least squares loss for regression, and the logistic loss or hinge

loss for classification (yt ∈ {-1, +1}). A core objective is to design algorithms with sub-linear regret (RegretT = o(T)), ensuring the average regret diminishes to zero as T → ∞. This no-regret property guarantees the learner's performance asymptotically matches the best fixed strategy in hindsight, even in non-stationary environments [Siddiqui et al., 2018]. Such frameworks underpin robust OAD systems, as outlined in Algorithm 1, by enabling adaptive model updates that balance immediate loss minimization with long-term stability.

Algorithm 1 Online Learning (OL) Algorithm for OAD

Require: the learning rate λ.

Ensure: the parameters of the classifier wT+1.

• 1: Initialization: w0 = 0
• 2: for t = 1, 2, · · · , T do
• 3: Receive xt ∈ Rd ;
• 4: Optimizewt = argminw∈Rd 12 ∥wt-1 -w∥22 +R(w), R(·) is the regularization term;
• 5: Predict ˆ yt = sign(wT t xt);
• 6: Receive true label yt ∈ {-1, 1} of xt;
• 7: Suffer the loss ℓt(wt) = [1 - ytwT t xt]+;
• 8: if ℓt(wt) > 0 then
• 9: Update wt+1 =wt -λt∇ℓt(wt);
• 10: else if ℓt(wt) ≤ 0 then
• 11: Update wt+1 =wt;
• 12: end if
• 13: end for
• 14: Return: wT+1

3.3 ℓ1,2 Regularization based SOL

In this section, we formalize the online anomaly detection problem and propose a sparse online learning method using ℓ1,2-mixed regularization to achieve structured sparsity. We first observe a key property of ℓ2 regularization: when |w|2 ≤ λ, the solution reduces to the zero vector (Theorem 1). While a zero weight vector lacks generalization power-potentially undermining its utility as a regularizer-this behavior proves advantageous in incremental online settings with grouped weights. In sparse online learning, for instance, each sliding window l (l = 1, . . . , L) employs a distinct weight vector wl ∈ Rd . The prediction for an instance x is the vector (⟨w1 , x⟩, . . . , ⟨wL, x⟩), with the final class determined by argmaxl⟨wl , x⟩. Since all wl operate on the same feature space, sparsity should be enforced collectively across corresponding features. Specifically, we seek to zero entire rows of the weight matrix w1 i ,w2 i , . . . ,wL i for each feature i (i = 1, . . . , d). Here, the ℓ2 regularizer's tendency to suppress entire weight vectors becomes valuable. By applying ℓ1,2 regularization-combining the ℓ1 sparsity and the ℓ2 shrinkage-we simultaneously achieve feature-wise sparsity while preserving non-zero weights' discriminative power.

Formally, let W ∈ Rd×L represent a d × L matrix where the l-th (l = 1, 2, · · · , L) column of the matrix is the weight vector wl , where d is the total number of all evolvable features. Thus, the i-th (i = 1, 2, · · · , d) row corresponds to the weight of the i-th feature with respect to all instances. The mixed ℓ1,2-norm of W, denoted ∥W∥ℓ1,2 , is obtained by computing the ℓ2-norm of each row of W and then applying the ℓ1-norm to the resulting d dimensional vector, i.e., ∥W∥ℓ1,2 = ∑di=1 ∥wi∥2. Thus, in a mixed-norm regularized optimization problem, we seek the minimizer of the objective function,

where f(W) is a loss function, we define specifically f(W) = 12 ∥W -Wt∥2F in our study.

Given the specific variants of various norms, the model update for the ℓ1,2 mixed-norm is readily available. Let wl ∈ Rd denote the l-th (l = 1, 2, · · · ,L) column of the matrix W ∈ Rd×L, i.e., W = [w1 ,w2 , · · · ,wL], and ¯wi ∈ RL denote the i-th (i = 1, 2, · · · , d) row of the matrix W ∈ Rd×L, i.e., W = [ ¯w1 ; ¯w2 ; · · · ; ¯wd ]. Analogously to the standard norm-based regularization, we let Wt = [wt-L+1,wt-L+2, · · · ,wt] ∈ Rd×L be the incremental matrix with all good feature alignment. For the ℓ1,2 mixed-norm, we need to solve the problem,

where ∥ · ∥2F is the Frobenius norm of a matrix and λ > 0 is the regularization parameter.

This problem is equivalent to

where ¯wi t is the i-th row of Wt. It is immediate to see that the problem given in Eq. (5) is decomposable into d separate problems of dimension L in Eq. (6), each of which can be solved by the procedures described in the following Theorem 1. The end result of solving these types of mixed-norm problems is a sparse matrix with numerous zero rows. In this way, this method can not only alleviate the curse of dimensionality by the incremental learning strategy, but also promote the sparsity of decremental and incremental features by considering feature correlations over time.

Theorem 1 (Closed-form Solution). The closed-form solution of the following ℓ2-norm minimization: ¯wi⋆ = argmin ¯wi∈RL{ 12 ∥ ¯wi - ¯wi t ∥22 + λ∥ ¯wi ∥2}, where i = 1, 2, · · · , d, is:

Remark 1: Theorem 1 can be proved with the proximal operator of the ℓ2-norm (Euclidean norm). It is worth noting that the ℓ2 regularization results in a zero weight vector under the condition that ∥ ¯wi t ∥2 ≤ λ. This condition is rather more stringent for sparsity than the condition for ℓ1 (where a weight is sparse based only on its value, while here, sparsity happens only if the entire weight vector has ℓ2-norm less than λ), so it is unlikely to hold in high dimensions. However, it does constitute a very important building block when using a mixed ℓ1/ℓ2-norm as the regularization function.

3.4 OAL through CURDecomposition

The CUR decomposition [Mahoney and Drineas, 2009] provides a low-rank approximation to a data matrix W ∈ Rd×L. In particular, CUR decomposes the data matrix W into the form of a product of three matrices as W ≈ CUR, where C ∈ Rd×c , U ∈ Rc×r , and R ∈ Rr×L (c < L and r < d). Unlike other low-rank approximations such as Singular Value Decomposition (SVD), CUR extracts C and R as small numbers of the column and row vectors of W, respectively. In other words, C and R are subsets of c columns and r rows of the original data matrix W, respectively. This property helps practitioners to interpret the result more easily than that in the case of SVD.

Since the R has been determined by the ℓ1,2 constraint (r rows of W will be zero vectors in Section 3.3), which imposes sparse rows of the incremental matrixW ∈ Rd×L. For the selection of C, the optimization problem is defined as:

where X ∈ RL×L is the parameter matrix, and η > 0 is a regularization parameter. Given the matrix W , W(i) ∈ R1×L and W (i) ∈ Rd×1 denote the i-th row vector and i-th column vector of W, respectively. Similarly, given a set of indices I, WI and W I denote the submatrices of W containing only I rows and columns, respectively. The term ∥X(i)∥2 induces X(i) to be a zero vector, where X(i) ∈ R1×L is the i-th row vector of X. The regularization constant η controls the degree of sparsity of the parameter matrix X. If X(i) = 0 is a zero vector, the corresponding column of the data matrix W (i) can be considered as an unimportant column for problem (5). On the other hand, W (i) is important when the corresponding X(i) is a nonzero vector. Therefore, we can select columns C as W I , where I ⊆ [L] = {1, 2, · · · ,L} represents the indices corresponding to the nonzero row vectors of X. Hence, the proposed algorithm can select more informative instances in the sliding window incrementally.

Problem (5) can be solved using the coordinate descent [Bien et al., 2010]. The algorithm iteratively updates each parameter vector X(i) corresponding to each row of the parameter matrix X until X converges. Then, the following equation is used to update X(i) ∈ R1×L:

where ui ∈ R1×L is computed by:

where W (i) ∈ Rd×1 denote the i-th column vector of W. Algorithm 2 shows the pseudocode of coordinate descent. The inner loop (lines 3-4) performs Equation (6) to update each row of X, and the outer loop (lines 2-5) repeats the update process until X converges. The computation cost of Equation (7) is O(L2d) time. Therefore, Equation (6) also requires O(L2d) time. Equation (6) can be modified to have O(Ld) time by updating the CUR every L rounds.

Algorithm 2 The CUR Decomposition Algorithm

1: [L] = {1, 2, · · · ,L}, X ← 0 ∈ RL×L;

• 2: repeat 3: for i ∈ [L] do 4: Update X(i) by Equation (6); 5: end for 6: until X converges.

3.5 Streaming Anomaly Detection through CUR Decomposition based Residual Errors

Residual analysis offers a principled approach to anomaly detection by quantifying deviations between observed data and their reconstructed estimates, where anomalies manifest as instances with disproportionately large residual errors due to divergence from dominant patterns. Traditional reconstruction methods rely on representative instances but face challenges from noisy or irrelevant attributes, necessitating joint selection of discriminative features and informative instances to accurately rebuild the underlying structure of the data matrix W. To address this, we extend beyond standard factorizations to CUR decomposition, which explicitly selects a subset of representative instances (C) and attributes (R) to form a low-rank approximation of W, enhancing interpretability and noise resilience. Mathematically, our proposed framework computes the residual matrix by

where ˜R is the residual matrix of the weight matrixW, and anomalies are identified by analyzing column-wise residuals:

a larger mixed norm ∥ ˜R⊤∥2,0 of ˜R(:, i) indicates that the i-th instance deviates significantly from the CUR-approximated structure, signaling higher anomaly likelihood. By integrating residual analysis with CUR's explicit instance-attribute selection, the method simultaneously mitigates noise interference and provides interpretable criteria for real-time anomaly ranking in dynamic streams.

4 Experimental Evaluation

4.1 Datasets and EvaluationMetrics

To validate the effectiveness of the proposed method, we conduct the experiments on nine streaming datasets and 10% of anomalies/outliers are randomly added in such datasets. Table 2 summarizes the attributes including number of samples, features, and classes. The online average error rate of the anomalies is utilized as the evaluation metric.

4.2 Experimental Settings

To evaluate the proposed SAD algorithm, we compare it with five state-of-the-art online anomaly detection algorithms: osPCA [Lee et al., 2012], sketch-OAD [Huang and Kasiviswanathan, 2015], VFDT [Tan et al., 2011], HATT [Bifet et al., 2017], and ARCUS [Yoon et al., 2022]. We implement all the competing algorithms in Matlab. For a fair comparison, the same experimental setup is applied to all algorithms. After the preliminary studies, we set the parameters by L = 50, λ = 10, and η = 1. All the other parameter values are determined based on [Lee et al., 2012; Huang and Kasiviswanathan, 2015; Tan et al., 2011; Bifet et al., 2017; Yoon et al., 2022]. Twenty independent runs are performed and the average results of each method are reported.

4.3 Overall Comparison

Table 1 presents the overall performance including average detection errors (±standard deviation) of all competing algorithms. Overall, SAD achieves the lowest classification errors in all the nine streaming datasets. The quantitative reductions (on average over the nine datasets) using the proposed SAD method and competing algorithms osPCA, sketch-OAD, VFDT, HATT, and ARCUS are 10.00%, 22.67%, 14.44%, 14.16%, and 9.04%, respectively.

4.4 Dynamic Error Rate Comparison

As shown in Figure 2, we investigate the dynamic error rate of all algorithms with the progression of a data stream. The online average error rate curves of SAD dominate the corresponding curves of all other algorithms (without much variation) on seven datasets except "german" and "ijcnn1". The superiority of SAD over others is evident on "codrna", "PCMAC", and "spambase" datasets. These results validate the efficiency of SAD compared to other competing algorithms.

4.5 Sensitivity Studies

To execute SAD, the regularization parameters λ and η need to be specified. We examine their impact on performance via grid search, using the large-scale "PCMAC" dataset with λ ∈ [10-2 , 10-1 , 100 , 101 , 2×101 , 5×101 , 102 ] and η ∈ [10-3 , 10-2 , 10-1 , 100 , 101 , 102 , 103 ]. As shown in Figure 3, which compares dynamic average detection error rates across parameter values, SAD exhibits stable performance for η ∈ [10-2 , 102 ] but fluctuates significantly with λ. When η is fixed, error rates increase sharply as λ decreases from 102 to 10-2 : smaller λ values promote higher sparsity but simultaneously degrade detection accuracy. Overall, SAD demonstrates robustness to η yet sensitivity to λ.

4.6 Empirical Studies on the Real-world Dataset

We evaluate our proposed approach using the KDDCUP intrusion detection dataset 1 , comprising 494,020 records across 34 dimensions with an anomaly rate of 1.77% (8,752 anomalies vs. 485,268 normal instances). All features are normalized via RobustScaler [Lusito et al., 2023], chosen for its outlier robustness. Figure 4 demonstrates the dynamic performance of competing algorithms under incremental data streaming. Both osPCA and our SAD method significantly outperform four baseline methods in detection error. Notably, SAD achieves superior performance with 3.38% average detection error compared to osPCA's 4.25%, confirming its enhanced scalability and competitive efficacy for realworld large-scale streaming data applications.

5 Conclusion

To address the challenge of consistently and accurately detecting unexpected anomalies in large-scale streaming settings without compromising computational and memory efficiency, this paper introduces an innovative Streaming Anomaly Detection (SAD) method rooted in sparse active online learning. Our primary contribution is the seamless integration of ℓ1,2-norm based sparse online learning with CUR decomposition based online active learning, which facilitates effective residual analysis for anomaly detection. This dual approach enables SAD to not only provide real-time feature interpretations through the ℓ1,2-norm penalty but also to automatically identify anomalies in streaming data. Crucially, this method eliminates the need for manually setting thresholds and does not rely on assumptions about data distribution. Our extensive evaluation across multiple streaming datasets underscores the efficacy of SAD, demonstrating significant performance enhancements over existing OAD competitors.

As part of future work, we plan to expand the applicability of our SAD method to more complex data streams encountered in open environments, including those involving feature evolution and weak supervision.

Acknowledgments

This work done by Y.He has been supported in part by the National Science Foundation (NSF) under Grant Nos. IIS-2236578, IIS-2441449, IOS-2446522, and the Commonwealth Cyber Initiative (CCI). The work done by Z. Chen has been supported in part by an Illinois Innovation Network (IIN) sustaining Illinois seed funding grant. The work done by other authors were not supported by any of these funds.

1 http://archive.ics.uci.edu/ml/datasets.php